A bankrupt crypto firm tried to return funds — but customer data might’ve been stolen instead